vim-patch:8.2.5046: vim_regsub() can overwrite the destination (#18812)

Problem:    vim_regsub() can overwrite the destination.
Solution:   Pass the destination length, give an error when it doesn't fit.
https://github.com/vim/vim/commit/4aaf3e7f4db599932d01d87e5bbcdc342cccee27

1 files changed, 4 insertions, 2 deletions

diff --git a/src/nvim/ex_cmds.c b/src/nvim/ex_cmds.c
index f6bdfc6175..ab0d58d749 100644
--- a/src/nvim/ex_cmds.c
+++ b/src/nvim/ex_cmds.c
@@ -4078,7 +4078,8 @@ static buf_T *do_sub(exarg_T *eap, proftime_T timeout, bool do_buf_event, handle
           // get length of substitution part
           sublen = vim_regsub_multi(&regmatch,
                                     sub_firstlnum - regmatch.startpos[0].lnum,
-                                    (char_u *)sub, (char_u *)sub_firstline, false, p_magic, true);
+                                    (char_u *)sub, (char_u *)sub_firstline, 0,
+                                    REGSUB_BACKSLASH | (p_magic ? REGSUB_MAGIC : 0));
           // If getting the substitute string caused an error, don't do
           // the replacement.
           // Don't keep flags set by a recursive call
@@ -4118,7 +4119,8 @@ static buf_T *do_sub(exarg_T *eap, proftime_T timeout, bool do_buf_event, handle
 
           (void)vim_regsub_multi(&regmatch,
                                  sub_firstlnum - regmatch.startpos[0].lnum,
-                                 (char_u *)sub, (char_u *)new_end, true, p_magic, true);
+                                 (char_u *)sub, (char_u *)new_end, sublen,
+                                 REGSUB_COPY | REGSUB_BACKSLASH | (p_magic ? REGSUB_MAGIC : 0));
           sub_nsubs++;
           did_sub = true;